About Bro Cluster Configuration

Zeek
1

Hello, I have a question about Bro Cluster architecture. By default, the
cluster architecture has a frontend listening to a ahigh-speed link;
spliting traffic to each worker and to finally all workers information
be administered by a manager using a proxy, etc.

What we want to do is to have several workers analysing different
networks segments and that each of those workers communicate with a
manager, who will be responsible for managing all information and of
course, enabling a centralized administration of workers configuration.

Is it possible to do this?

Thanks and regards.

2

Yes, this should be fine. The standard architecture is meant to
provide load-balancing for monitoring points that are too large for a
single system to monitor (> 4-5 Gbps with modern, beefy hardware). As
long as each Bro worker is seeing both the upflow and downflow of each
connection it sees, the cluster doesn't care about which worker sees
which subset of the overall traffic.

  --Vlad

Cristian Daniel Barbaro <cbarbaro@cert.unlp.edu.ar> writes:

3

Perfect. I'll try it.

Thanks.